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A mendments t o Oie Cfaims : 
This listing or claims replaces all prior versions and li);tiiij;s of claims in the appllr;iiion: 
ListtHj^ o f Cl aims : 



1. (Currently Amcndc-ri) An article comprising a muchinc-rcadablc mrHii 
embodying instnirlions that when perfomtcd by one or more m-ichincs result in o,Kialioii8 
comprising: 

detemilning whether a ..lomgc device, in a data processing system running an operatine 
system. Includes iH«»te«e4<iwa stops^JlSlJ^^ ihr operating system including o 
hardware abstraction Juyer; 

lemoving the storage aiea protection oFthe storage device from ;virliin the ninning 
operating system and ivitDoui rebooting the dNf» processing sysiein jhe!2l>x.crefttJ.n£iL£m^ 
protected Rtormr a jrca; and 

providir^i; informotioti derivod from the foimcrly protected sroraae area to adnta 
pror.t-As-ing sysicm deleclion tool; 

wherein said determining and said removing occur in a kernel mode of the d:iia 
processing sysieni. 

2. (Original) The arlicle of cfnim J , wherein th^; opL-rating s>stcin further includes a 
graphical user interface (GUI), virtual memory management and multitasking. 

3. (Currcni ly Amended) The article of claim 1 . wltcnrin detennining whether the 
storage device includes the p»eteete4««u afijragcjapa p TOtoetion comprises: 

checking wlwihcr the storage device supports a protected area spcoitlcation; and 
identifying a protected storage capacity and an unprotected storage capacity of (he 
storage device. 
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4. (Original) The article of ctaini 1 , wherein rtynioving Ihe alomge area protection 
comprises volatilely rcsctiinf^ a storage address value. 

5. (Original) The article of claim 4, Tvhrrcin resetting a storage address value 
comprises calling a MAX ADDRESS command. 

6. (C;mr.r(lcd) 

7. (Original) The article of claim 4, wherein (he storage area prnlection oflbe 
siorafje device i8 restored by the data pnx:wsing system upon system reboot, IcavinH; the storage 
device unaltered. 

R. (Chiginal) The article of claim 1 , wherein the operations further comprise: 

scynnin^? the for/nerly protected 5l:of«ti2 area; and 

identifying file sysfem information in the fomierly protected storage area. 

9. (Original) The article of claijTi \ , wherein pTx>vidin£ ihi: infonration derived from 
the fonncriy protect<2d storage area comprises .scmjing the infnmiation over a traasport medium 
to the data processing system detection looL 

10. (Original) The article of claim 9, wherein the operations ftjrthcr cnmprlsc 
reconsiructinfi a file system of the formerly protected storage area lo derive the information, 

1 1 . (Original) The article of claim 9, wherein pnovidin^i the infontiation derived from 
the fonncriy protpcied storage area further comprises sclcciing the tran.«tport. medium from a 
group including a peripheral device interface medium and a network communications medium. 
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1 2. (CuireiiTly Amended) An article cojiipriaing a machine-readable medium 
embodying insinjctions lhal when perfonncd hy nnt- nr more machines result in operalions 
cemprising: 

determining whclher a storftgo device, in a dala processing syslum riinninii: an operating 
system, included a proieote dnarga stQmg.c antn protp cdon. die operating system including o 
hardware alwtractinn layer, 

TTcmovinii tlie storage area protcclion of the storage dcvict: Tnim witliin the mnning 
operating system and without rebooting the data processing syytem^ttierebv creatin g n formerly 
protected storage area: and 

providinsi information derived from ihi: formerly protected storage ai^a to a data 
processing systcin ddcciion lool; 

wherein providing the information derived from the formerly protcdaJ storage area 
comprises sending the infomiiitioJi nvt^r a transport medium to Che data proccseing system 
detection tooJ; 

wherein providing the infomiation derived from the fomicrly protected storage area 
further comprises sclcciing the transport medium from a group includinEj a peripheral device 
interface medium and a network communications medium; and 

wherein sending the information ovttr the transport medium comprises sending the 
information in parkds having Ji packet structure useable over both the peripheral device interface 
medium and tlic network communieations medium. 

1 3, (Original) The article of chiim 1?, wherein the packet structure is useable over a 
UaivCTsal Serial Bus (USB) and over an hitcmct Protocol (JP) network, 

M. (Originiil) The article of claim 12, wherein the packet structure mchides h p:ickct 
ideniilier field, and the operations further comprise specifying a deteciion^iool packet identifier 
for each packet 
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1 5. (Original) The article of claim 12, wherein the packet structure allows for only a 
one-to-one connection. 

1 6. (Original) The urtictc of clnim 1 2, wherein the packet strueiuie specifics small 
packets to fi^^lucc latency. 

1 7. (Currently Amended) A method comprising: 

loading Q kernel-mode soflwan: mo<lulc in n mmpiiting liystem running an operating 
system; and 

without rcbootiiit^ the computing system, using the kcmcl-modc snftw;irc module to 
perform operations from wilhm thr operating system, the opcmrions cotnpri&ing 

rictcrminlng whether a storage device in the computing system includes frf wte(Ht^^-i««ft 
storaRc are a jirotoction, and 

rcvcrsibly removing the storage urea protection , (hereby cr eatiim a formerl y protected 
storage area . 

1 8. (Oriftinal) The nwthod of claim 1 7, wherein loqdins the kernd-njodc sodware 
module comprijsc^i cnmmunicatively coupling a macbme-reaclable medium with the computing 
system, a detociion :igent being tangibly embodied in the machitic-rc?Klabki mrttium to nm and 
dynamically load the kernei-motic softwan; mf>iiulr without altering tlic siomge device. 

1 9. (Original) Thiz mr-thod of claim I wherein the machine-readable medium 
comprises an oplieal disk. 

20. (Original) T]\c method of claim 1 7, fiirthcr 
scanning the formerly pmtcclcd storage area; and 

identifying file system information in the formerly protected storage «irca. 
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2 1 . (Original) The mtMhod of claim 1 7, funher comprising jjending inforroation 
derived from tho formerly pmttxied storage area over a selected iraiisport medium to a daia 
procKssing system detection tool. 

22. (Original) TI>c method of claim ?. I , wherein scmdinR ih» infoniialion over the 
sclijclcd transport medium cmripriscs sending the infomiation in packets having packet 
stajciurc uscahlc. over both a peripheral device interface medium and a nciworlc communications 
medium. 

23. (Original) The mcdw] ofclaim 22, whcnjin the packet structure indtkte a packet 
identifier firtd used by ihe detcclioa tool, and the packet xJnTcturc specifies small packets to 
reduce latency, 

2^1 . (Original) A system romprising: 
a dalH processing system detection tool; and 

a kcrtt6l-modo goRwarc module opi:nihle to provide the detection loo) with access to u 
protected arcfl of « Moragc device in a data procossinij system when the kcmcl-modc sortware 
module is loaded into the data processiing system. 

25. (Origiroi) The system of claim 24, wherein the detection tool is operable from 
within the dat« processinfi system to access the storage device over a bus, the system further 
comprising a hardware wrile blocker operable to allow the kcmel-modc software module access 
to a fimiware command. 

26. (Orijiinul) Thn ^sim of claim 24, wherein the detection tool is operable a5 a 
stand alone application and as a client application. 
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27. (Original) The system ofclain, 24, further comprising a dcloction agent operable 
10 send information lo (he detection tool, the detection agent being openil>lc l., bad the kernel- 
mode sonware module in the data processing system and communicate with the loaded kernel- 
mode software module end wiUi the detection tool 

28. (Original) The sy.stcm of claim 27. wherein Uic detection «£t:ni is further operable 
to rceonsirucr ;i fii,: system of the protected slorugc area and send the reconstructed file system 
infonnaiion lo the dclection tool. 

2$>. (OrisinnJ) The .-^ysiriT, of claLn 27. wherein (ho detection agent i.s fiinhcr operable 
to select a transport medium firom a Rroup including a pcriphrn.1 device interface mwlium and a 
network cornmunieations medium, and (he detection ageni coninwnicaUis with Uie dctcttiion tool 
usinft u common a packet sinicturc useable over both the peripheral device interface medium and 
the nciwork communications medium. 

30. (Original) The system of claim 29. witcrcin the packet structure includes a packet 
identifier field used by the detection tool, and ifte packet structare .-specifics .small packets lo 
reduce latency. 

3 1 . (Original) The system of claim 24. (urthcr comprising a soAware write blocker. 

32. (Original) The system ofclaim 24, wherein the detection tool compri.s(is h 
computer forcaiie? tool. 

33. (Original) The system of claim 24, wherein the kemel-mode software moduJc 
comprises a device driver. 

34. (Original) The system ofclaim 33, wherein the device driver comprises a 
Window.i Driver Model (WDM) driver. 
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35. (Original) The system nf claim 33, whcnsin Ihe storage device comprises an ATA 
hard disk. 

36. (Currently Anjctided) A system comprising- 

means for directly accessing u pTOtcr icd area of a sioraRC device in a data processing 
system live from a high level opa-ating system without a reboot; and 

means for delivering inroimation derived finm ihe protected sU.rjBe area to a data 
processing Kystem detection tool: 

wherein the means for delivering comprifies mulli-lranspnrt mains for delivering the 
infotmaiion. includinft means Ibr sdssiiyslx commiJiiicaiing over a network c ommunicat ion. 
/»ed.ium_oLajicrie!^ lo support remote imaging and analysis of die 

directly nccrsscd protected area. 

37. (Cancelled) 
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